1) Client doesn't actually care about the OK reply at all, and tries to
send some command immediately after connecting.

2) You're using the "high-security mode" of login processes, which is
why there is a small delay before login process gets a reply from auth.
You could switch to either "high-performance
mode" (http://wiki2.dovecot.org/LoginProcess) or probably just setting
service imap-login { process_min_avail } to some small number also
helps.